internal from #392 gate #402

New issue

Closed

opened 2026-07-05 00:05:05 +02:00 by herald · 0 comments

herald commented

2026-07-05 00:05:05 +02:00

Owner

Post-v1.0.0 tightening candidate. Deferred hardening surfaced during the #397/#398 Codeberg-primary arc (Bosun ratified KEEP-allowlist for now; Surveyor registered independent agreement + this tie-in for whenever it's revisited). Non-urgent — filed so the insight isn't lost.

The coupled improvement

Two changes that only make sense together:

Route cold-read/README.md step-4 output to the internal wiki. Step 4 currently says "File a triangulation summary at {date}-triangulation.md" and the capture format drops {date}-{model}-{surface}.md files into docs/internal/cold-read/. Those are point-in-time artifacts — the same class #398 moved to the wiki. Routing them to the wiki makes the framework's output-policy consistent with the "point-in-time → wiki" policy #398 established.
Remove docs/internal/ from .register-allowlist. With the archaeology already off-tree (#398) and cold-read/ register-scrubbed clean, the allowlist entry is the only thing keeping cold-read/ cleanliness unenforced by the #392 gate. De-allowlisting makes the gate durably enforce it — guarding against future concurrent-authorship name-drift (the exact failure mode the register-audit arc kept hitting).

Why they're coupled

The allowlist is currently load-bearing because of step-4: a literal cold-read run drops a name-bearing capture (verbatim external-model output + framework notes) back into the allowlisted dir. De-allowlisting without routing step-4 output elsewhere would make the next cold-read run either (a) fail the gate, or (b) leak names into the now-public (Codeberg-primary) source tree. Do both → framework output-policy and gate-scope become consistent.

Empirical validation (Surveyor, #401 review)

Tested with docs/internal/ removed from .register-allowlist: the gate still exits 0 today (everything left post-#398-scrub is clean). So de-allowlisting costs nothing now + gives durable enforcement — the only precondition is fixing the step-4 output routing so future runs don't reintroduce the class.

Scope

docs/internal/cold-read/README.md — step-4 + capture-format sections route output to the internal wiki (book 209) instead of the repo dir
.register-allowlist — drop the docs/internal/ line
Verify: register-check.sh green with the line removed; a documented cold-read run produces no in-tree capture files

Anchor

#397/#398 Codeberg-primary shift, 2026-07-04. Deferred per Bosun (v1.1.0 tightening candidate; same defer-until-real-FP-observation reasoning as #396 line-level allow syntax). Same maintainer-internal-hardening class.

**Post-v1.0.0 tightening candidate.** Deferred hardening surfaced during the #397/#398 Codeberg-primary arc (Bosun ratified KEEP-allowlist for now; Surveyor registered independent agreement + this tie-in for whenever it's revisited). Non-urgent — filed so the insight isn't lost. ## The coupled improvement Two changes that only make sense together: 1. **Route `cold-read/README.md` step-4 output to the internal wiki.** Step 4 currently says *"File a triangulation summary at `{date}-triangulation.md`"* and the capture format drops `{date}-{model}-{surface}.md` files **into `docs/internal/cold-read/`**. Those are point-in-time artifacts — the same class #398 moved to the wiki. Routing them to the wiki makes the framework's output-policy consistent with the "point-in-time → wiki" policy #398 established. 2. **Remove `docs/internal/` from `.register-allowlist`.** With the archaeology already off-tree (#398) and cold-read/ register-scrubbed clean, the allowlist entry is the only thing keeping cold-read/ cleanliness *unenforced* by the #392 gate. De-allowlisting makes the gate durably enforce it — guarding against future concurrent-authorship name-drift (the exact failure mode the register-audit arc kept hitting). ## Why they're coupled The allowlist is currently **load-bearing** *because* of step-4: a literal cold-read run drops a name-bearing capture (verbatim external-model output + framework notes) back into the allowlisted dir. De-allowlisting *without* routing step-4 output elsewhere would make the next cold-read run either (a) fail the gate, or (b) leak names into the now-public (Codeberg-primary) source tree. Do both → framework output-policy and gate-scope become consistent. ## Empirical validation (Surveyor, #401 review) Tested with `docs/internal/` removed from `.register-allowlist`: the gate **still exits 0** today (everything left post-#398-scrub is clean). So de-allowlisting costs nothing now + gives durable enforcement — the only precondition is fixing the step-4 output routing so future runs don't reintroduce the class. ## Scope - `docs/internal/cold-read/README.md` — step-4 + capture-format sections route output to the internal wiki (book 209) instead of the repo dir - `.register-allowlist` — drop the `docs/internal/` line - Verify: `register-check.sh` green with the line removed; a documented cold-read run produces no in-tree capture files ## Anchor #397/#398 Codeberg-primary shift, 2026-07-04. Deferred per Bosun (v1.1.0 tightening candidate; same defer-until-real-FP-observation reasoning as #396 line-level allow syntax). Same maintainer-internal-hardening class.

herald added the

kind/docs

priority/low

size/S

labels

2026-07-05 00:05:14 +02:00